The demo tag existed to give Fly.io a stable tag to pull. Now that
the build job only runs on main, we can pass the exact dated image
ref to flyctl deploy --image instead, eliminating the mutable tag.

https://claude.ai/code/session_01FVsSU48JEru2VWWeLAN7Tn

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8805608..7cf7bc2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.meta.outputs.version }}
+      image: ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }}
     steps:
       - uses: actions/checkout@v6
       - uses: ruby/setup-ruby@v1
@@ -49,7 +50,6 @@ jobs:
           images: ghcr.io/${{ github.repository }}
           tags: |
             type=raw,value={{date 'YYYYMMDD'}}-${{ steps.short-sha.outputs.sha }}
-            type=raw,value=demo
       - uses: docker/build-push-action@v6
         with:
           context: .
@@ -95,7 +95,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: superfly/flyctl-actions/setup-flyctl@master
-      - run: flyctl deploy
+      - run: flyctl deploy --image ${{ needs.build.outputs.image }}
         env:
           FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
 
diff --git a/fly.toml b/fly.toml
index 9137f2f..4ddb20d 100644
--- a/fly.toml
+++ b/fly.toml
@@ -6,9 +6,6 @@
 app = 'ketchup-t1zvtw'
 primary_region = 'sjc'
 
-[build]
-  image = 'ghcr.io/kejadlen/ketchup:demo'
-
 [http_service]
   internal_port = 9292
   force_https = true